ESBD_File_328573_Addendum 2_Attachment 5_Exhibit O_HHS Information Security and Privacy Requirements.pdf

Standards and Regulations:

Contractors are required to comply with HHS Information Security and Privacy requirements in order to maintain a business relationship with Te xas HHS. Accordingly, contractors are required to adhere to all applicable standards and regulations (and their associated security controls) to include state laws, federal laws, executive orders, policies, regulations, standards, and guidance.

Standards and Regulations that Apply to this Contract:

Based on data types that are accessed, created, disclosed, received, transmitted, maintained, or stored within Information System(s) of this contract the following standards and regulations apply:

Texas HHS Requirements:

The contractor is responsible for implementing the HHS MODERATE (NIST SP 800-53R4 MODERATE equivalent) security baseline and the HIPAA overlay found in the IS-Controls and the following Texas HHS standards and regulations:

• Information Security Controls (IS-Controls)

• Information Security Risk Assessment Monitoring Process (IS-RAMP)

• Security and Privacy Inquiry (SPI)

• Information Security Web & Mobile Standard (IS-Web & Mobile)

State and Federal Requirements:

The contractor is additionally responsible for implementing following state and federal standards and regulations:

HHS0013244 - Recovery Audit Contractor Services, Exhibit O

Texas Health and Human Services Information Security and Privacy Requirements

• Texas Department of Information Resources (DIR) Security Control Standards Catalog

• Health Insurance Portability and Accountability Act of 1996 (HIPAA)

• NIST SP 800-66, An Introductory Resource Guide for Implementing the HIPAA Security Rule

• US Department of Health and Human Services HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework

Contract Monitoring:

Contractors are required to fulfill HHS monitoring requirements for continuing compliance as outlined in the IS-RAMP.

Required Information Security & Privacy Controls that Apply to this Contract:

Table 1 below is a list of required security controls mandated by the applicable state and federal regulations listed above. The contractor is required to implement the following list of Information Security and Privacy controls unless there exists a documented agreement that establishes Texas Health and Human Services as the provider for a specified control(s).

Additionally, the contractor is required to implement any additional controls added or modified in subsequent updates to applicable standards and regulations.

If more than one applicable Standard and/or Regulation requires the same Information Security and Privacy control, then the contractor must implement the most restrictive requirements for the specified control.

Table 1: Information Security & Privacy Controls Minimum Baseline that apply to this Contract

Control ID Control Name

AC-01 ACCESS CONTROL POLICY AND PROCEDURES

AC-02 ACCOUNT MANAGEMENT

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

Control ID Control Name

AC-02(01) AUTOMATED SYSTEM ACCOUNT MANAGEMENT

AC-02(02) REMOVAL OF TEMPORARY / EMERGENCY ACCOUNTS

AC-02(03) DISABLE INACTIVE ACCOUNTS

AC-02(04) AUTOMATED AUDIT ACTIONS

AC-03 ACCESS ENFORCEMENT

AC-04 INFORMATION FLOW ENFORCEMENT

AC-05 SEPARATION OF DUTIES

AC-06 LEAST PRIVILEGE

AC-06(01) AUTHORIZE ACCESS TO SECURITY FUNCTIONS

AC-06(02) NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS

AC-06(05) PRIVILEGED ACCOUNTS

AC-06(09) AUDITING USE OF PRIVILEGED FUNCTIONS

AC-06(10) PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED

FUNCTIONS

AC-07 UNSUCCESSFUL LOGON ATTEMPTS

AC-08 SYSTEM USE NOTIFICATION

AC-11 SESSION LOCK

AC-11(01) PATTERN-HIDING DISPLAYS

AC-12 SESSION TERMINATION

AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION

AC-16 SECURITY ATTRIBUTES

AC-17 REMOTE ACCESS

AC-17(01) AUTOMATED MONITORING / CONTROL

AC-17(02) PROTECTION OF CONFIDENTIALITY / INTEGRITY USING ENCRYPTION

AC-17(03) MANAGED ACCESS CONTROL POINTS

AC-17(04) PRIVILEGED COMMANDS / ACCESS

AC-18 WIRELESS ACCESS

AC-18(01) AUTHENTICATION AND ENCRYPTION

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

AC-19 ACCESS CONTROL FOR MOBILE DEVICES

AC-19(05) FULL DEVICE / CONTAINER-BASED ENCRYPTION

AC-20 USE OF EXTERNAL INFORMATION SYSTEMS

AC-20(01) LIMITS ON AUTHORIZED USE

AC-20(02) PORTABLE STORAGE DEVICES

AC-21 INFORMATION SHARING

AC-22 PUBLICLY ACCESSIBLE CONTENT

AT-01 SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES

AT-02 SECURITY AWARENESS TRAINING

AT-02(02) INSIDER THREAT

AT-03 ROLE-BASED SECURITY TRAINING

AT-04 SECURITY TRAINING RECORDS

AU-01 AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES

AU-02 AUDIT EVENTS

AU-02(03) REVIEWS AND UPDATES

AU-03 CONTENT OF AUDIT RECORDS

AU-03(01) ADDITIONAL AUDIT INFORMATION

AU-04 AUDIT STORAGE CAPACITY

AU-05 RESPONSE TO AUDIT PROCESSING FAILURES

AU-06 AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-06(01) PROCESS INTEGRATION

AU-06(03) CORRELATE AUDIT REPOSITORIES

AU-07 AUDIT REDUCTION AND REPORT GENERATION

AU-07(01) AUTOMATIC PROCESSING

AU-08 TIME STAMPS

AU-08(01) SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE

AU-09 PROTECTION OF AUDIT INFORMATION

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

AU-09(04) ACCESS BY SUBSET OF PRIVILEGED USERS

AU-11 AUDIT RECORD RETENTION

AU-12 AUDIT GENERATION

AU-13 MONITORING FOR INFORMATION DISCLOSURE

CA-01 SECURITY ASSESSMENT AND AUTHORIZATION POLICY AND PROCEDURES

CA-02 SECURITY ASSESSMENTS

CA-02(01) INDEPENDENT ASSESSORS

CA-03 SYSTEM INTERCONNECTIONS

CA-03(05) RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS

CA-05 PLAN OF ACTION AND MILESTONES

CA-05(01) AUTOMATION SUPPORT FOR ACCURACY / CURRENCY

CA-06 SECURITY AUTHORIZATION

CA-07 CONTINUOUS MONITORING

CA-07(01) INDEPENDENT ASSESSMENT

CA-08 PENETRATION TESTING

CA-09 INTERNAL SYSTEM CONNECTIONS

CM-01 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES

CM-02 BASELINE CONFIGURATION

CM-02(01) REVIEWS AND UPDATES

CM-02(03) RETENTION OF PREVIOUS CONFIGURATIONS

CM-03 CONFIGURATION CHANGE CONTROL

CM-03(02) TEST / VALIDATE / DOCUMENT CHANGES

CM-04 SECURITY IMPACT ANALYSIS

CM-04(01) SEPARATE TEST ENVIRONMENTS

CM-05 ACCESS RESTRICTIONS FOR CHANGE

CM-06 CONFIGURATION SETTINGS

CM-07 LEAST FUNCTIONALITY

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

CM-07(01) PERIODIC REVIEW

CM-07(02) PREVENT PROGRAM EXECUTION

CM-07(04) UNAUTHORIZED SOFTWARE / BLACKLISTING

CM-08 INFORMATION SYSTEM COMPONENT INVENTORY

CM-08(01) UPDATES DURING INSTALLATIONS / REMOVALS

CM-08(03) AUTOMATED UNAUTHORIZED COMPONENT DETECTION

CM-08(05) NO DUPLICATE ACCOUNTING OF COMPONENTS

CM-09 CONFIGURATION MANAGEMENT PLAN

CM-10 SOFTWARE USAGE RESTRICTIONS

CM-11 USER-INSTALLED SOFTWARE

CP-01 CONTINGENCY PLANNING POLICY AND PROCEDURES

CP-02 CONTINGENCY PLAN

CP-02(01) COORDINATE WITH RELATED PLANS

CP-02(03) RESUME ESSENTIAL MISSIONS / BUSINESS FUNCTIONS

CP-02(05) CONTINUE ESSENTIAL MISSIONS / BUSINESS FUNCTIONS

CP-02(08) IDENTIFY CRITICAL ASSETS

CP-03 CONTINGENCY TRAINING

CP-04 CONTINGENCY PLAN TESTING

CP-04(01) COORDINATE WITH RELATED PLANS

CP-06 ALTERNATE STORAGE SITE

CP-06(01) SEPARATION FROM PRIMARY SITE

CP-06(03) ACCESSIBILITY

CP-07 ALTERNATE PROCESSING SITE

CP-07(01) SEPARATION FROM PRIMARY SITE

CP-07(02) ACCESSIBILITY

CP-07(03) PRIORITY OF SERVICE

CP-08 TELECOMMUNICATIONS SERVICES

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

CP-08(01) PRIORITY OF SERVICE PROVISIONS

CP-08(02) SINGLE POINTS OF FAILURE

CP-09 INFORMATION SYSTEM BACKUP

CP-09(01) TESTING FOR RELIABILITY / INTEGRITY

CP-10 INFORMATION SYSTEM RECOVERY AND RECONSTITUTION

CP-10(02) TRANSACTION RECOVERY

CP-11 ALTERNATE COMMUNICATIONS PROTOCOLS

IA-01 IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES

IA-02 IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)

IA-02(01) NETWORK ACCESS TO PRIVILEGED ACCOUNTS

IA-02(08) NETWORK ACCESS TO PRIVILEGED ACCOUNTS - REPLAY RESISTANT

IA-02(11) REMOTE ACCESS - SEPARATE DEVICE

IA-03 DEVICE IDENTIFICATION AND AUTHENTICATION

IA-04 IDENTIFIER MANAGEMENT

IA-05 AUTHENTICATOR MANAGEMENT

IA-05(01) PASSWORD-BASED AUTHENTICATION

IA-05(02) PKI-BASED AUTHENTICATION

IA-05(03) IN-PERSON OR TRUSTED THIRD-PARTY REGISTRATION

IA-05(07) NO EMBEDDED UNENCRYPTED STATIC AUTHENTICATORS

IA-05(11) HARDWARE TOKEN-BASED AUTHENTICATION

IA-06 AUTHENTICATOR FEEDBACK

IA-07 CRYPTOGRAPHIC MODULE AUTHENTICATION

IA-08 IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS)

IR-01 INCIDENT RESPONSE POLICY AND PROCEDURES

IR-02 INCIDENT RESPONSE TRAINING

IR-03 INCIDENT RESPONSE TESTING

IR-03(02) COORDINATION WITH RELATED PLANS

IR-04 INCIDENT HANDLING

IR-04(01) AUTOMATED INCIDENT HANDLING PROCESSES

IR-05 INCIDENT MONITORING

IR-06 INCIDENT REPORTING

IR-06(01) AUTOMATED REPORTING

IR-07 INCIDENT RESPONSE ASSISTANCE

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

IR-07(01) AUTOMATION SUPPORT FOR AVAILABILITY OF INFORMATION / SUPPORT

IR-08 INCIDENT RESPONSE PLAN

MA-01 SYSTEM MAINTENANCE POLICY AND PROCEDURES

MA-02 CONTROLLED MAINTENANCE

MA-03 MAINTENANCE TOOLS

MA-03(01) INSPECT TOOLS

MA-03(02) INSPECT MEDIA

MA-04 NONLOCAL MAINTENANCE

MA-04(02) DOCUMENT NONLOCAL MAINTENANCE

MA-05 MAINTENANCE PERSONNEL

MA-06 TIMELY MAINTENANCE

MP-01 MEDIA PROTECTION POLICY AND PROCEDURES

MP-02 MEDIA ACCESS

MP-03 MEDIA MARKING

MP-04 MEDIA STORAGE

MP-05 MEDIA TRANSPORT

MP-05(04) CRYPTOGRAPHIC PROTECTION

MP-06 MEDIA SANITIZATION

MP-07 MEDIA USE

MP-07(01) PROHIBIT USE WITHOUT OWNER

PE-01 PHYSICAL AND ENVIRONMENTAL PROTECTION POLICY AND PROCEDURES

PE-02 PHYSICAL ACCESS AUTHORIZATIONS

PE-03 PHYSICAL ACCESS CONTROL

PE-04 ACCESS CONTROL FOR TRANSMISSION MEDIUM

PE-05 ACCESS CONTROL FOR OUTPUT DEVICES

PE-06 MONITORING PHYSICAL ACCESS

PE-06(01) INTRUSION ALARMS / SURVEILLANCE EQUIPMENT

PE-08 VISITOR ACCESS RECORDS

PE-09 POWER EQUIPMENT AND CABLING

PE-10 EMERGENCY SHUTOFF

PE-11 EMERGENCY POWER

PE-12 EMERGENCY LIGHTING

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

PE-13 FIRE PROTECTION

PE-13(03) AUTOMATIC FIRE SUPPRESSION

PE-14 TEMPERATURE AND HUMIDITY CONTROLS

PE-15 WATER DAMAGE PROTECTION

PE-16 DELIVERY AND REMOVAL

PE-17 ALTERNATE WORK SITE

PE-18 LOCATION OF INFORMATION SYSTEM COMPONENTS

PE-19 INFORMATION LEAKAGE

PE-20 ASSET MONITORING AND TRACKING

PL-01 SECURITY PLANNING POLICY AND PROCEDURES

PL-02 SYSTEM SECURITY PLAN

PL-02(03) PLAN / COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES

PL-04 RULES OF BEHAVIOR

PL-04(01) SOCIAL MEDIA AND NETWORKING RESTRICTIONS

PL-08 INFORMATION SECURITY ARCHITECTURE

PS-01 PERSONNEL SECURITY POLICY AND PROCEDURES

PS-02 POSITION RISK DESIGNATION

PS-03 PERSONNEL SCREENING

PS-04 PERSONNEL TERMINATION

PS-05 PERSONNEL TRANSFER

PS-06 ACCESS AGREEMENTS

PS-07 THIRD-PARTY PERSONNEL SECURITY

PS-08 PERSONNEL SANCTIONS

RA-01 RISK ASSESSMENT POLICY AND PROCEDURES

RA-02 SECURITY CATEGORIZATION

RA-03 RISK ASSESSMENT

RA-05 VULNERABILITY SCANNING

RA-05(01) UPDATE TOOL CAPABILITY

RA-05(02) UPDATE BY FREQUENCY / PRIOR TO NEW SCAN / WHEN IDENTIFIED

RA-05(05) PRIVILEGED ACCESS

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

SA-01 SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURES

SA-02 ALLOCATION OF RESOURCES

SA-03 SYSTEM DEVELOPMENT LIFE CYCLE

SA-04 ACQUISITION PROCESS

SA-04(01) FUNCTIONAL PROPERTIES OF SECURITY CONTROLS

SA-04(02) DESIGN / IMPLEMENTATION INFORMATION FOR SECURITY CONTROLS

SA-04(09) FUNCTIONS / PORTS / PROTOCOLS / SERVICES IN USE

SA-05 INFORMATION SYSTEM DOCUMENTATION

SA-08 SECURITY ENGINEERING PRINCIPLES

SA-09 EXTERNAL INFORMATION SYSTEM SERVICES

SA-09(02) IDENTIFICATION OF FUNCTIONS / PORTS / PROTOCOLS / SERVICES

SA-09(05) PROCESSING, STORAGE, AND SERVICE LOCATION

SA-10 DEVELOPER CONFIGURATION MANAGEMENT

SA-11 DEVELOPER SECURITY TESTING AND EVALUATION

SA-11(01) STATIC CODE ANALYSIS

SA-11(02) THREAT AND VULNERABILITY ANALYSES

SA-11(05) PENETRATION TESTING

SA-11(08) DYNAMIC CODE ANALYSIS

SA-12 SUPPLY CHAIN PROTECTION

SA-14 CRITICALITY ANALYSIS

SA-15 DEVELOPMENT PROCESS, STANDARDS, AND TOOLS

SA-17 DEVELOPER SECURITY ARCHITECTURE AND DESIGN

SC-01 SYSTEM AND COMMUNICATIONS PROTECTION POLICY AND PROCEDURES

SC-02 APPLICATION PARTITIONING

SC-04 INFORMATION IN SHARED RESOURCES

SC-05 DENIAL OF SERVICE PROTECTION

SC-07 BOUNDARY PROTECTION

SC-07(03) ACCESS POINTS

SC-07(04) EXTERNAL TELECOMMUNICATIONS SERVICES

SC-07(05) DENY BY DEFAULT / ALLOW BY EXCEPTION

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

SC-07(07) PREVENT SPLIT TUNNELING FOR REMOTE DEVICES

SC-08 TRANSMISSION CONFIDENTIALITY AND INTEGRITY

SC-08(01) CRYPTOGRAPHIC OR ALTERNATE PHYSICAL PROTECTION

SC-10 NETWORK DISCONNECT

SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT

SC-13 CRYPTOGRAPHIC PROTECTION

SC-15 COLLABORATIVE COMPUTING DEVICES

SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES

SC-18 MOBILE CODE

SC-19 VOICE OVER INTERNET PROTOCOL

SC-20 SECURE NAME / ADDRESS RESOLUTION SERVICE (AUTHORITATIVE

SOURCE)

SC-21 SECURE NAME / ADDRESS RESOLUTION SERVICE (RECURSIVE OR

CACHING RESOLVER)

SC-22 ARCHITECTURE AND PROVISIONING FOR NAME / ADDRESS RESOLUTION

SERVICE

SC-23 SESSION AUTHENTICITY

SC-28 PROTECTION OF INFORMATION AT REST

SC-28(01) CRYPTOGRAPHIC PROTECTION

SC-31 COVERT CHANNEL ANALYSIS

SC-39 PROCESS ISOLATION

SC-44 DETONATION CHAMBERS

SI-01 SYSTEM AND INFORMATION INTEGRITY POLICY AND PROCEDURES

SI-02 FLAW REMEDIATION

SI-02(02) AUTOMATED FLAW REMEDIATION STATUS

SI-03 MALICIOUS CODE PROTECTION

SI-03(01) CENTRAL MANAGEMENT

SI-03(02) AUTOMATIC UPDATES

SI-04 INFORMATION SYSTEM MONITORING

SI-04(02) AUTOMATED TOOLS FOR REAL-TIME ANALYSIS

SI-04(04) INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

SI-04(05) SYSTEM-GENERATED ALERTS

SI-05 SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

SI-07 SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY

SI-07(01) INTEGRITY CHECKS

SI-07(07) INTEGRATION OF DETECTION AND RESPONSE

SI-08 SPAM PROTECTION

SI-08(01) CENTRAL MANAGEMENT

SI-08(02) AUTOMATIC UPDATES

SI-10 INFORMATION INPUT VALIDATION

SI-11 ERROR HANDLING

SI-12 INFORMATION HANDLING AND RETENTION

SI-16 MEMORY PROTECTION

PM-01 INFORMATION SECURITY PROGRAM PLAN

PM-02 SENIOR INFORMATION SECURITY OFFICER

PM-03 INFORMATION SECURITY RESOURCES

PM-04 PLAN OF ACTION AND MILESTONES PROCESS

PM-05 INFORMATION SYSTEM INVENTORY

PM-06 INFORMATION SECURITY MEASURES OF PERFORMANCE

PM-07 ENTERPRISE ARCHITECTURE

PM-08 CRITICAL INFRASTRUCTURE PLAN

PM-09 RISK MANAGEMENT STRATEGY

PM-10 SECURITY AUTHORIZATION PROCESS

PM-11 MISSION/BUSINESS PROCESS DEFINITION

PM-12 INSIDER THREAT PROGRAM

PM-13 INFORMATION SECURITY WORKFORCE

PM-14 TESTING, TRAINING, AND MONITORING

PM-15 CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS

PM-16 THREAT AWARENESS PROGRAM

AR-01 GOVERNANCE AND PRIVACY PROGRAM

IP-01 CONSENT

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)

SE-01 INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION

TR-01 PRIVACY NOTICE

UL-01 INTERNAL USE

Exhibit Q - HHS Information Security and Privacy Requirements (HHS0012814 Random Moment Sampling System)